Back
Lesson 1 of 6

AIOps Fundamentals for Security

Objective

This lesson introduces the fundamentals of AIOps for security: what AIOps is, why it matters to security teams, and the operational shift from reactive to proactive to autonomous operations. You will learn how AIOps ingests firewall telemetry (logs, health metrics, flow data), discovers patterns, and surfaces guided remediation. In production, AIOps is used to reduce Mean Time To Detect/Remediate (MTTD/MTTR) across hundreds or thousands of firewalls and to turn noisy telemetry into actionable insights. Real-world scenario: a newly hired firewall engineer must triage a fleet of customer firewalls and rapidly find unused, overlapping, or risky rules — AIOps identifies those patterns and recommends safe remediation steps.

Topology & Device Table

Network Topology Diagram

Key Concepts (theory before CLI)

  • What AIOps is: AIOps (Artificial Intelligence for IT Operations) aggregates telemetry (logs, metrics, traces, flow records) and applies pattern analysis, correlation, and inference to produce prioritized, actionable insights. Think of AIOps as a "security researcher" that reads all of your firewalls' output and points out recurring problems.
    • Real-world: In a large enterprise, manually parsing millions of logs per day is impossible — AIOps reduces noise and surfaces only high-impact items.
  • Reactive vs Proactive vs Autonomous:
    • Reactive: You respond after an alert (e.g., someone notices a breach or outage).
    • Proactive: System predicts or highlights risky configurations (e.g., unused open ports, capacity exhaustion) before they cause incidents.
    • Autonomous: System performs safe, validated remediations automatically (e.g., auto-remediating a misconfigured access rule after validation).
  • Telemetry Sources & Protocol Behavior:
    • Syslog: Firewalls send log messages (often via UDP 514 or TCP 6514) to collectors. Logs are immediate events (connections, denies, config changes). In production, use reliable transport (TCP/TLS) where possible.
    • NetFlow/IPFIX: Flow exporters send per-flow records at intervals (active_timeout/inactive_timeout). AIOps uses flow data to detect elephant flows and capacity issues.
    • Health metrics: CPU, memory, disk, throughput counters sampled at regular intervals. AIOps establishes baselines and detects anomalies.
  • Pattern discovery and inference:
    • AIOps correlates logs, flows, and events across multiple devices and time to find root cause patterns (e.g., a spike in denied traffic preceded by a misapplied rule).
  • Safety & Collaboration:
    • AIOps should propose prescriptive changes and integrate with change management (e.g., ServiceNow) so human reviewers can approve or slow-roll changes.

Step-by-step configuration

Each step below includes commands, why they matter, and verification with expected output.

Step 1: Configure basic management connectivity on Edge-Router and Firewall

What we are doing: Configure the management IP addresses and hostnames so devices can reach the AIOps collector. Reliable management connectivity is the foundation for telemetry export, API calls, and secure communications.

Edge-Router# configure terminal
Edge-Router(config)# hostname Edge-Router
Edge-Router(config)# interface GigabitEthernet0/0
Edge-Router(config-if)# ip address 10.0.0.1 255.255.255.0
Edge-Router(config-if)# no shutdown
Edge-Router(config-if)# exit
Edge-Router(config)# interface GigabitEthernet0/1
Edge-Router(config-if)# ip address 192.168.1.1 255.255.255.0
Edge-Router(config-if)# no shutdown
Edge-Router(config-if)# end
Edge-Router# write memory

Secure-FW-1# configure terminal
Secure-FW-1(config)# hostname Secure-FW-1
Secure-FW-1(config)# interface mgmt0
Secure-FW-1(config-if)# ip address 10.0.0.2 255.255.255.0
Secure-FW-1(config-if)# no shutdown
Secure-FW-1(config-if)# end
Secure-FW-1# write memory

What just happened: These commands set hostnames and management IP addresses. The router and firewall will now be reachable on the 10.0.0.0/24 management network. Management reachability is required before any telemetry export or API registration can succeed.

Real-world note: In production, management interfaces are often placed on a separate out-of-band (OOB) network to isolate control traffic from user data.

Verify:

Edge-Router# show ip interface brief
Interface              IP-Address      OK? Method Status                Protocol
GigabitEthernet0/0     10.0.0.1        YES manual up                    up
GigabitEthernet0/1     192.168.1.1     YES manual up                    up

Secure-FW-1# show ip interface brief
Interface              IP-Address      OK? Method Status                Protocol
mgmt0                  10.0.0.2        YES manual up                    up
inside0                192.168.1.2     YES manual up                    up

Step 2: Configure Syslog from Firewall to the AIOps Collector

What we are doing: Point firewall syslog messages to the AIOps collector (10.0.0.10). Syslog is the primary source for event-level data (connection accepts/denies, policy changes, system alerts).

Secure-FW-1# configure terminal
Secure-FW-1(config)# logging host 10.0.0.10 transport tcp port 6514
Secure-FW-1(config)# logging trap informational
Secure-FW-1(config)# logging on
Secure-FW-1(config)# end
Secure-FW-1# write memory

What just happened: The firewall will forward log messages to 10.0.0.10 over TCP port 6514 (commonly used for secure syslog). Setting the trap level to informational ensures normal traffic and system events are forwarded. Reliable transport (TCP/TLS) improves delivery guarantees compared to UDP.

Real-world note: Use TLS-encrypted syslog wherever possible to protect log confidentiality and integrity, especially when sending logs over shared networks.

Verify:

Secure-FW-1# show logging
Syslog logging: enabled
    Console logging: disabled
    Monitor logging: disabled
    Buffer logging: disabled (0 messages dropped)
    Trap logging: level informational
Log host: 10.0.0.10 transport tcp port 6514

Expected output explanation: The show logging output confirms syslog is enabled and shows the configured collector address and transport.

Step 3: Configure Flow Export (NetFlow/IPFIX) on Edge-Router

What we are doing: Enable flow export on the router that fronts the firewall so the AIOps collector receives flow records. Flows let AIOps detect elephant flows, top talkers, and capacity trends.

Edge-Router# configure terminal
Edge-Router(config)# flow exporter AIOPS-EXP
Edge-Router(config-flow-export)# description Export to AIOps collector
Edge-Router(config-flow-export)# destination 10.0.0.10
Edge-Router(config-flow-export)# transport udp 2055
Edge-Router(config-flow-export)# exit
Edge-Router(config)# flow monitor AIOPS-MON v9
Edge-Router(config-flow-monitor)# exporter AIOPS-EXP
Edge-Router(config-flow-monitor)# record netflow-original
Edge-Router(config-flow-monitor)# exit
Edge-Router(config)# interface GigabitEthernet0/1
Edge-Router(config-if)# ip flow monitor AIOPS-MON input
Edge-Router(config-if)# ip flow monitor AIOPS-MON output
Edge-Router(config-if)# end
Edge-Router# write memory

What just happened: A flow exporter and monitor were created and applied to the LAN interface to capture flows in both directions. Exporter points to 10.0.0.10 on UDP 2055. The collector will now receive flow records summarizing traffic conversations.

Real-world note: In high-throughput environments use IPFIX with batching and compression to reduce overhead on collectors.

Verify:

Edge-Router# show flow monitor AIOPS-MON cache
Flow Monitor: AIOPS-MON
Cache Entries: 0
Active Flows: 0
    Flow records will appear here once traffic traverses the monitored interface
Edge-Router# show flow exporter
Flow Exporter: AIOPS-EXP
 Type: NetFlow
 Destination: 10.0.0.10
 Transport: UDP/2055
 Packets Exported: 0

Expected output explanation: Initially counters may be zero until traffic flows. The configuration lines confirm exporter and monitor exist and point at the collector.

Step 4: Baseline health metrics collection (SNMP / polling)

What we are doing: Enable basic health metrics collection so AIOps can establish dynamic baselines for CPU, memory, and throughput. Most collectors poll via SNMP; enabling here allows consistent sampling.

Secure-FW-1# configure terminal
Secure-FW-1(config)# snmp-server community NHPREP_RO RO
Secure-FW-1(config)# snmp-server host 10.0.0.10 NHPREP_RO
Secure-FW-1(config)# end
Secure-FW-1# write memory

What just happened: A read-only SNMP community "NHPREP_RO" was created and associated with the collector host. AIOps collectors will poll MIBs for health counters. With these metrics, AIOps can detect deviations from normal patterns.

Real-world note: Use SNMPv3 in production for encryption and better authentication. RO community is a simplification for labs.

Verify:

Secure-FW-1# show running-config | include snmp
snmp-server community NHPREP_RO RO
snmp-server host 10.0.0.10 NHPREP_RO

Step 5: Validate end-to-end telemetry and observe an insight

What we are doing: Confirm the collector can receive telemetry (syslog and flows) and check that AIOps identified at least one basic insight (e.g., an unexpected open port or traffic spike). This step demonstrates the full data path from device to AIOps insight.

Edge-Router# ping 10.0.0.10
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.0.0.10, timeout is 2 seconds:
!!!!! 
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/2/4 ms

Secure-FW-1# show logging
Syslog logging: enabled
    Log host: 10.0.0.10 transport tcp port 6514

Edge-Router# show flow exporter
Flow Exporter: AIOPS-EXP
 Destination: 10.0.0.10
 Transport: UDP/2055
 Packets Exported: 12

Secure-FW-1# show snmp
SNMP Server: enabled
  Communities:
    NHPREP_RO (RO) -> 10.0.0.10

What just happened: Ping confirms connectivity. Flow exporter shows exported packets (meaning flows reached the collector). Syslog shows the collector is configured. On the AIOps UI (analyst.lab.nhprep.com), you would now see collected logs and flows and a basic "Health Insight" such as "High SSH denied attempts from host 192.168.1.50" or "Unused rule candidate #233" depending on traffic.

Real-world note: AIOps platforms often take minutes to ingest and analyze data; watch for initial indexing delays when you first connect devices.

Verify (collector-side example — UI/API access; use lab credentials):

# Example CLI to test API authentication (simulated)
# (Note: In labs, replace with the UI at https://analyst.lab.nhprep.com)
curl -k -u admin:Lab@123 https://10.0.0.10/api/v1/status
{
  "status": "ok",
  "services": {
    "syslog_ingest": "running",
    "flow_ingest": "running",
    "metrics_ingest": "running"
  }
}

Expected output explanation: This JSON shows ingestion services are up. In production the UI would present correlated insights, prioritized alerts and suggested remediations.

Verification Checklist

  • Check 1: Management connectivity. Verify firewall and router can reach collector with:
    • Edge-Router: show ip interface brief and ping 10.0.0.10
  • Check 2: Syslog forwarding configured and active on firewall:
    • Secure-FW-1: show logging — expect Log host 10.0.0.10 transport tcp port 6514
  • Check 3: Flow export sending records:
    • Edge-Router: show flow exporter — expect Destination 10.0.0.10 and Packets Exported > 0 after traffic
  • Check 4: Collector accepting telemetry:
    • Collector API: curl -k -u admin:Lab@123 https://10.0.0.10/api/v1/status — expect ingestion services running

Common Mistakes

SymptomCauseFix
No logs appear in AIOps UIFirewall logging directed to wrong IP/port or transport mismatchVerify show logging and correct logging host 10.0.0.10 transport tcp port 6514; ensure firewall has route to collector
Flow exporter shows 0 packets exportedFlow monitor not applied to the correct interface or no traffic matchedConfirm ip flow monitor AIOPS-MON input/output applied on correct interface and generate test traffic
Collector shows partial data (logs but no flows)Network ACL or firewall blocking UDP/2055 from router to collectorCheck edge-device ACLs and ensure UDP/2055 allowed; validate with ping and show flow exporter counters
Metrics missing / no SNMP pollingSNMP community mismatch or polling source IP blockedVerify snmp-server community NHPREP_RO RO and that collector IP matches; consider SNMPv3 for production

Key Takeaways

  • AIOps transforms raw telemetry (syslog, flows, metrics) into prioritized security insights — the first step is reliable, secure telemetry transport.
  • Reactive operations respond to alerts; proactive operations use pattern discovery and baselining to prevent incidents; autonomous operations apply safe remediations after validation.
  • In production, secure transports (TLS for syslog, authenticated SNMPv3, and IPFIX) and separate management networks are essential to protect telemetry.
  • Start small: enable logging and flows for a subset of devices, validate ingestion and insights, then scale across the estate with automation and integrated change control.

Tip: Think of AIOps as a microscope for operational data — it magnifies patterns humans miss at scale. In production, governance around suggested changes (approval workflows) protects against unintended consequences.

This concludes Lesson 1: "AIOps Fundamentals for Security." In the next lesson we will configure policy analytics and run a sample Policy Optimizer to identify unused and overlapping firewall rules.

Practice with Hands-On Labs

30 step-by-step labs for CCNA, CCNP Enterprise & Security